ci: fail the sonarcloud job when the quality gate fails

[NachoVazquez]

TL;DR

The SonarCloud job passes the moment the report finishes uploading, so the GitHub check said green while the quality gate sat at ERROR on main — undetected since 2020. Setting sonar.qualitygate.wait=true makes the scanner poll for the verdict and exit non-zero when the gate fails.

Follow-up to #232, which cleared the 22 code smells that had the gate red. Gate on main is now OK with 0 failing conditions, so this flag lands green.

Why

sonarqube-scan-action uploads the analysis and returns. Computing the gate happens server-side afterwards, and nothing was reading the result — the check reported on the upload, not the verdict. Any gate regression was invisible in CI and only discoverable by opening the SonarCloud dashboard.

	Before	After
Job passes when	Report uploads	Gate returns OK
Gate ERROR on main	Check stays green	Job fails
Gate ERROR on a PR	Check stays green	Check blocks merge

Reviewer notes

• Placed in sonar-project.properties, not the workflow. It applies to every analysis — pull request and main — rather than only the one CI step, and it lives beside the exclusions it interacts with.
• PR analyses are judged on new code only. SonarCloud evaluates just the new_* conditions on pull requests, so this blocks a PR that introduces smells without holding it responsible for pre-existing ones.
• This makes the gate load-bearing, which raises the stakes on its conditions. Ngworkers Quality Gate (id 40275) still judges overall code via code_smells > 0 and sqale_index > 0. Those are satisfiable today at 0, but three of the five smells fixed in chore: clear sonarcloud code smells failing the quality gate #232 appeared purely from analyzer upgrades, with no code change. The next such release turns a red gate into a red main. Dropping both conditions — new_code_smells > 0 already covers what matters — needs org-admin access in the SonarCloud UI and is the recommended companion to this PR.
• Adds roughly 30 seconds to the job. The scanner polls the compute-engine task; default timeout is 300s.

Tests

Config-only. Verified configure-sonar-report-paths.mjs still rewrites both placeholders with the new property present, and nx format:check is clean. The real proof is this PR's own SonarCloud check, which now reflects the gate rather than the upload.

Links

• #232 — cleared the code smells this depends on
• SonarCloud project dashboard

[nx-cloud]

View your CI Pipeline Execution ↗ for commit b6cedd4

Command	Status	Duration	Result
nx run-many --target=test --configuration=ci --...	✅ Succeeded	<1s	View ↗
nx run-many --target=lint --configuration=repor...	✅ Succeeded	17s	View ↗
nx affected -t test --configuration=ci	✅ Succeeded	<1s	View ↗
nx affected -t lint build e2e	✅ Succeeded	<1s	View ↗
nx-cloud record -- nx format:check	✅ Succeeded	<1s	View ↗

💡 Verify your cache is correct by running tasks in a sandbox. Read docs ↗

---

☁️ Nx Cloud last updated this comment at 2026-07-25 19:48:54 UTC

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud